Syntax:

Runs on:

QNX Neutrino

Options:

-A

Load only the queue rules present in the rule file.
Other rules and options are ignored.

-aanchor

Apply the -f, -F, and -s options only
to the rules in the specified anchor.
In addition to the main rule set, pfctl can load and
manipulate additional rule sets by name, called anchors.
The main rule set is the default anchor.

Anchors are referenced by name and may be nested, with the various
components of the anchor path separated by slashes (/),
similar to how file system hierarchies are laid out.
The last component of the anchor path is where rule-set operations are performed.

Evaluation of anchor rules from the main rule set is described in the documentation for pf.conf.

Private tables can also be put inside anchors, either by having
table statements in the pf.conf file that is loaded in the
anchor, or by using regular table commands, as in:

pfctl -a foo/bar -t mytable -T add 1.2.3.4 5.6.7.8

When a rule referring to a table is loaded in an anchor, the rule
will use the private table if one is defined, and then fall back
to the table defined in the main rule set, if there is one.
This is similar to C rules for variable scope.
It is possible to create distinct tables with the same name in the
global rule set and in an anchor, but this is often bad design,
and a warning is issued in that case.

-Dmacro=value

Define macro to be set to value on the command line.
This overrides the definition of macro in the rule set.

-d

Disable the packet filter.

-e

Enable the packet filter.

-Fmodifier

Flush the filter parameters specified by modifier (which you can abbreviate):

Load the rules contained in the specified file.
This file may contain macros, tables, options, and normalization, queueing, translation, and filtering rules.
With the exception of macros and tables, the statements must appear in that order.

Specify - for the file to use standard input.

-g

Include output helpful for debugging.

-h

Display some help information.

-iinterface

Restrict the operation to the given interface.

-khost

Kill all of the state entries originating from the specified host.
You can specify a second -k option, which will kill
all the state entries from the first host to the second host.
For example, to kill all of the state entries originating from host:

pfctl -k host

To kill all of the state entries from host1 to host2:

pfctl -k host1 -k host2

-m

Merge in explicitly given options without resetting those that are omitted.
This option lets you modify single options without disturbing the others:

echo "set loginterface fxp0" | pfctl -mf -

-N

Load only the NAT rules present in the rule file.
Other rules and options are ignored.

-n

Don't actually load rules; just parse them.

-O

("Oh") Load only the options present in the rule file.
Other rules and options are ignored.

-o

Enable the rule-set optimizer, which attempts to improve rule sets by removing rule duplication and making better
use of rule ordering.
Specifically, it does the following:

removes duplicate rules

removes rules that are a subset of another rule

combines multiple rules into a table when advantageous

reorders the rules to improve evaluation performance

You can specify a second -o option to use the currently
loaded rule set as a feedback profile to tailor the optimization of
the quick rules to the actual network behavior.

Note:
The rule-set optimizer modifies the rule set to improve performance.
A side effect of the ruleset modification is that per-rule accounting
statistics will have different meanings than before.
If per-rule accounting is important (e.g. for billing purposes),
either you shouldn't use the rule-set optimizer, or you should add a
label field to all of the accounting rules to act as optimization barriers.

-pdevice

Use the device file device instead of the default, /dev/pf.
This can be useful if you're using more than one instance of io-pkt.
For example:

Load only the filter rules present in the rule file.
Other rules and options are ignored.

-r

Perform reverse DNS lookups on states when displaying them.

-smodifier

Show the filter parameters specified by modifier (which you can abbreviate):

nat — show the currently loaded NAT rules.

queue — show the currently loaded queue rules.
When used together with -v, pfctl also shows per-queue statistics.
When used together with -v -v, pfctl
loops and shows updated queue statistics every five seconds,
including measured bandwidth and packets per second.

rules — show the currently loaded filter rules.
When used together with -v, pfctl also shows the per-rule
statistics (number of evaluations, packets and bytes).

Note that the skip step optimization done
automatically by io-pkt skips the evaluation of rules where possible.
Packets passed statefully are counted in the rule that created the
state (even though the rule isn't evaluated more than once for the entire connection).

Anchors — show the currently loaded anchors directly attached to the main ruleset.
If you also specify -aanchor, the anchors
loaded directly below the given anchor are shown instead.
If you specify -v, all anchors attached under the target anchor are displayed recursively.

state — show the contents of the state table.

Sources — show the contents of the source-tracking table.

info — show filter information (statistics and counters).
When used together with -v, source tracking statistics are also shown.

labels — show per-rule statistics (label, evaluations,
packets, bytes) of filter rules with labels.
This can be useful for accounting.

timeouts — show the current global timeouts.

memory — show the current pool memory hard limits.

Tables — show the list of tables.

osfp — show the list of operating system fingerprints.

Interfaces — show the list of interfaces and interface drivers available to PF.
When used together with a double -v option, pfctl
also shows interface statistics.
You can use the -i option to select an interface or a group of interfaces.

all — show all of the above, except for the lists of
interfaces and operating system fingerprints.

-Tcommand [address ...]

Specify the command (which you can abbreviate) to apply to the table.
The commands include:

kill — kill a table.

flush — flush all addresses of a table.

add — add one or more addresses in a table.
Automatically create a nonexisting table.

delete — delete one or more addresses from a table.

replace — replace the addresses of the table.
Automatically create a nonexisting table.

show — show the content (addresses) of a table.

test — test if the given addresses match a table.

zero — clear all the statistics of a table.

load — load only the table definitions from pf.conf.
You use this in conjunction with the -f option, as in:

pfctl -Tl -f pf.conf

For the add, delete, replace, and
test commands, you can specify the list of addresses
either directly on the command line and/or in an unformatted text file, using the -f flag.
Comments starting with a # are allowed in the text file.
With these commands, you can also use the -v option once
or twice, in which case pfctl prints the detailed result
of the operation for each individual address, prefixed by one of the following letters:

A — the address/network has been added.

C — the address/network has been changed (negated).

D — the address/network has been deleted.

M — the address matches (test operation only).

X — the address/network is duplicated and therefore ignored.

Y — the address/network can't be added/deleted due
to conflicting ! attributes.

Z — the address/network has been cleared (statistics).

Each table maintains a set of counters that you can retrieve using the -v option.
For example, the following commands define a wide-open firewall that
keeps track of packets going to or coming from the OpenBSD FTP server.
The following commands configure the firewall and send 10 pings to the FTP server:

We can now use the table show command to output, for each address
and packet direction, the number of packets and bytes that are
being passed or blocked by rules referencing the table.
The time at which the current accounting started is also shown with the Cleared line:

Similarly, you can view global information about the
tables by using the -v option twice with the -s Tables command.
This displays the number of addresses on each table, the number of
rules that reference the table, and the global packet statistics for the whole table:

In this case, only one packet—the initial ping request—matched the table,
but all packets passing as the result of the state are correctly accounted for.
Reloading the table(s) or ruleset doesn't affect packet accounting in any way.
The two XPass counters are incremented instead of the
Pass counters when a "stateful" packet is passed but doesn't match the table anymore.
This will happen in our example if someone were to flush the table while
the ping command was running.

When used with a single -v, pfctl displays only
the first line containing the table flags and name.
The flags are defined as follows:

c — constant tables, which can't be altered outside pf.conf.

p — persistent tables, which don't get
automatically killed when no rules refer to them.

a — tables that are part of the active table set.
Tables without this flag don't really exist, can't contain
addresses, and are listed only if you specify the -g option.

i — tables that are part of the inactive table set.
This flag can be witnessed only briefly during the loading of pf.conf.

r — tables that are referenced (used) by rules.

h — a table in the main rule set is hidden by one or more tables of
the same name from anchors attached below it.

-ttable

Specify the name of the table.

-v

Produce more verbose output.
If you specify a second -v, pfctl produces
even more verbose output including rule set warnings.
See above for its effect on table commands.

-xlevel

Set the debugging level to one of the following (which you can abbreviate):

none — don't generate debug messages.

urgent — generate debug messages only for serious errors.

misc — generate debug messages for various errors.

loud — generate debug messages for common conditions.

-z

Clear per-rule statistics.

Description:

The pfctl utility communicates with the packet filter device
using the ioctl() or ioctl_socket() interface described in
pf.
It lets you configure rule sets and parameters and retrieve status
information from the packet filter.

Packet filtering restricts the types of packets that pass through network
interfaces entering or leaving the host based on filter rules as described in
pf.conf.
The packet filter can also replace addresses and ports of packets.
Replacing source addresses and ports of outgoing
packets is called NAT (Network Address Translation) and is used to connect
an internal network (usually reserved address space) to an external
one (the Internet) by making all connections to external hosts appear to come from the gateway.
Replacing destination addresses and ports of incoming packets is used to
redirect connections to different hosts and/or ports.
A combination of both translations, bidirectional NAT, is also supported.
Translation rules are described in the documentation for pf.conf.

The packet filter doesn't itself forward packets between interfaces.
Forwarding can be enabled by setting the
sysctl
variables
net.inet.ip.forwarding and/or
net.inet6.ip6.forwarding to 1.
Set them permanently in a file such as /etc/sysctl.conf,
and then start sysctl using that file.
For example: